tcpdump  4.99.1
About: tcpdump is a tool for network monitoring and data acquisition.
  Fossies Dox: tcpdump-4.99.1.tar.gz  ("unofficial" and yet experimental doxygen-generated source code documentation)  

print-llc.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 1992, 1993, 1994, 1995, 1996, 1997
3  * The Regents of the University of California. All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that: (1) source code distributions
7  * retain the above copyright notice and this paragraph in its entirety, (2)
8  * distributions including binary code include the above copyright notice and
9  * this paragraph in its entirety in the documentation or other materials
10  * provided with the distribution, and (3) all advertising materials mentioning
11  * features or use of this software display the following acknowledgement:
12  * ``This product includes software developed by the University of California,
13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14  * the University nor the names of its contributors may be used to endorse
15  * or promote products derived from this software without specific prior
16  * written permission.
17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20  *
21  * Code by Matt Thomas, Digital Equipment Corporation
22  * with an awful lot of hacking by Jeffrey Mogul, DECWRL
23  */
24 
25 /* \summary: IEEE 802.2 LLC printer */
26 
27 #ifdef HAVE_CONFIG_H
28 #include <config.h>
29 #endif
30 
31 #include "netdissect-stdinc.h"
32 
33 #include "netdissect.h"
34 #include "addrtoname.h"
35 #include "extract.h"
36 
37 #include "llc.h"
38 #include "ethertype.h"
39 #include "oui.h"
40 
41 static const struct tok llc_values[] = {
42  { LLCSAP_NULL, "Null" },
43  { LLCSAP_GLOBAL, "Global" },
44  { LLCSAP_8021B_I, "802.1B I" },
45  { LLCSAP_8021B_G, "802.1B G" },
46  { LLCSAP_IP, "IP" },
47  { LLCSAP_SNA, "SNA" },
48  { LLCSAP_PROWAYNM, "ProWay NM" },
49  { LLCSAP_8021D, "STP" },
50  { LLCSAP_RS511, "RS511" },
51  { LLCSAP_ISO8208, "ISO8208" },
52  { LLCSAP_PROWAY, "ProWay" },
53  { LLCSAP_SNAP, "SNAP" },
54  { LLCSAP_IPX, "IPX" },
55  { LLCSAP_NETBEUI, "NetBeui" },
56  { LLCSAP_ISONS, "OSI" },
57  { 0, NULL },
58 };
59 
60 static const struct tok llc_cmd_values[] = {
61  { LLC_UI, "ui" },
62  { LLC_TEST, "test" },
63  { LLC_XID, "xid" },
64  { LLC_UA, "ua" },
65  { LLC_DISC, "disc" },
66  { LLC_DM, "dm" },
67  { LLC_SABME, "sabme" },
68  { LLC_FRMR, "frmr" },
69  { 0, NULL }
70 };
71 
72 static const struct tok llc_flag_values[] = {
73  { 0, "Command" },
74  { LLC_GSAP, "Response" },
75  { LLC_U_POLL, "Poll" },
76  { LLC_GSAP|LLC_U_POLL, "Final" },
77  { LLC_IS_POLL, "Poll" },
78  { LLC_GSAP|LLC_IS_POLL, "Final" },
79  { 0, NULL }
80 };
81 
82 
83 static const struct tok llc_ig_flag_values[] = {
84  { 0, "Individual" },
85  { LLC_IG, "Group" },
86  { 0, NULL }
87 };
88 
89 
90 static const struct tok llc_supervisory_values[] = {
91  { 0, "Receiver Ready" },
92  { 1, "Receiver not Ready" },
93  { 2, "Reject" },
94  { 0, NULL }
95 };
96 
97 
98 static const struct tok cisco_values[] = {
99  { PID_CISCO_CDP, "CDP" },
100  { PID_CISCO_VTP, "VTP" },
101  { PID_CISCO_DTP, "DTP" },
102  { PID_CISCO_UDLD, "UDLD" },
103  { PID_CISCO_PVST, "PVST" },
104  { PID_CISCO_VLANBRIDGE, "VLAN Bridge" },
105  { 0, NULL }
106 };
107 
108 static const struct tok bridged_values[] = {
109  { PID_RFC2684_ETH_FCS, "Ethernet + FCS" },
110  { PID_RFC2684_ETH_NOFCS, "Ethernet w/o FCS" },
111  { PID_RFC2684_802_4_FCS, "802.4 + FCS" },
112  { PID_RFC2684_802_4_NOFCS, "802.4 w/o FCS" },
113  { PID_RFC2684_802_5_FCS, "Token Ring + FCS" },
114  { PID_RFC2684_802_5_NOFCS, "Token Ring w/o FCS" },
115  { PID_RFC2684_FDDI_FCS, "FDDI + FCS" },
116  { PID_RFC2684_FDDI_NOFCS, "FDDI w/o FCS" },
117  { PID_RFC2684_802_6_FCS, "802.6 + FCS" },
118  { PID_RFC2684_802_6_NOFCS, "802.6 w/o FCS" },
119  { PID_RFC2684_BPDU, "BPDU" },
120  { 0, NULL },
121 };
122 
123 static const struct tok null_values[] = {
124  { 0, NULL }
125 };
126 
127 struct oui_tok {
128  uint32_t oui;
129  const struct tok *tok;
130 };
131 
132 static const struct oui_tok oui_to_tok[] = {
134  { OUI_CISCO_90, ethertype_values }, /* uses some Ethertype values */
135  { OUI_APPLETALK, ethertype_values }, /* uses some Ethertype values */
136  { OUI_CISCO, cisco_values },
137  { OUI_RFC2684, bridged_values }, /* bridged, RFC 2427 FR or RFC 2864 ATM */
138  { 0, NULL }
139 };
140 
141 /*
142  * If we printed information about the payload, returns the length of the LLC
143  * header, plus the length of any SNAP header following it.
144  *
145  * Otherwise (for example, if the packet has unknown SAPs or has a SNAP
146  * header with an unknown OUI/PID combination), returns the *negative*
147  * of that value.
148  */
149 int
150 llc_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen,
151  const struct lladdr_info *src, const struct lladdr_info *dst)
152 {
153  uint8_t dsap_field, dsap, ssap_field, ssap;
154  uint16_t control;
155  int hdrlen;
156  int is_u;
157 
158  ndo->ndo_protocol = "llc";
159  if (caplen < 3) {
160  nd_print_trunc(ndo);
161  ND_DEFAULTPRINT((const u_char *)p, caplen);
162  return (caplen);
163  }
164  if (length < 3) {
165  nd_print_trunc(ndo);
166  ND_DEFAULTPRINT((const u_char *)p, caplen);
167  return (length);
168  }
169 
170  dsap_field = GET_U_1(p);
171  ssap_field = GET_U_1(p + 1);
172 
173  /*
174  * OK, what type of LLC frame is this? The length
175  * of the control field depends on that - I frames
176  * have a two-byte control field, and U frames have
177  * a one-byte control field.
178  */
179  control = GET_U_1(p + 2);
180  if ((control & LLC_U_FMT) == LLC_U_FMT) {
181  /*
182  * U frame.
183  */
184  is_u = 1;
185  hdrlen = 3; /* DSAP, SSAP, 1-byte control field */
186  } else {
187  /*
188  * The control field in I and S frames is
189  * 2 bytes...
190  */
191  if (caplen < 4) {
192  nd_print_trunc(ndo);
193  ND_DEFAULTPRINT((const u_char *)p, caplen);
194  return (caplen);
195  }
196  if (length < 4) {
197  nd_print_trunc(ndo);
198  ND_DEFAULTPRINT((const u_char *)p, caplen);
199  return (length);
200  }
201 
202  /*
203  * ...and is little-endian.
204  */
205  control = GET_LE_U_2(p + 2);
206  is_u = 0;
207  hdrlen = 4; /* DSAP, SSAP, 2-byte control field */
208  }
209 
210  if (ssap_field == LLCSAP_GLOBAL && dsap_field == LLCSAP_GLOBAL) {
211  /*
212  * This is an Ethernet_802.3 IPX frame; it has an
213  * 802.3 header (i.e., an Ethernet header where the
214  * type/length field is <= MAX_ETHERNET_LENGTH_VAL,
215  * i.e. it's a length field, not a type field), but
216  * has no 802.2 header - the IPX packet starts right
217  * after the Ethernet header, with a signature of two
218  * bytes of 0xFF (which is LLCSAP_GLOBAL).
219  *
220  * (It might also have been an Ethernet_802.3 IPX at
221  * one time, but got bridged onto another network,
222  * such as an 802.11 network; this has appeared in at
223  * least one capture file.)
224  */
225 
226  if (ndo->ndo_eflag)
227  ND_PRINT("IPX 802.3: ");
228 
229  ipx_print(ndo, p, length);
230  return (0); /* no LLC header */
231  }
232 
233  dsap = dsap_field & ~~LLC_IG;
234  ssap = ssap_field & ~~LLC_GSAP;
235 
236  if (ndo->ndo_eflag) {
237  ND_PRINT("LLC, dsap %s (0x%02x) %s, ssap %s (0x%02x) %s",
238  tok2str(llc_values, "Unknown", dsap),
239  dsap,
240  tok2str(llc_ig_flag_values, "Unknown", dsap_field & LLC_IG),
241  tok2str(llc_values, "Unknown", ssap),
242  ssap,
243  tok2str(llc_flag_values, "Unknown", ssap_field & LLC_GSAP));
244 
245  if (is_u) {
246  ND_PRINT(", ctrl 0x%02x: ", control);
247  } else {
248  ND_PRINT(", ctrl 0x%04x: ", control);
249  }
250  }
251 
252  /*
253  * Skip LLC header.
254  */
255  p += hdrlen;
256  length -= hdrlen;
257  caplen -= hdrlen;
258 
259  if (ssap == LLCSAP_SNAP && dsap == LLCSAP_SNAP
260  && control == LLC_UI) {
261  /*
262  * XXX - what *is* the right bridge pad value here?
263  * Does anybody ever bridge one form of LAN traffic
264  * over a networking type that uses 802.2 LLC?
265  */
266  if (!snap_print(ndo, p, length, caplen, src, dst, 2)) {
267  /*
268  * Unknown packet type; tell our caller, by
269  * returning a negative value, so they
270  * can print the raw packet.
271  */
272  return (-(hdrlen + 5)); /* include LLC and SNAP header */
273  } else
274  return (hdrlen + 5); /* include LLC and SNAP header */
275  }
276 
277  if (ssap == LLCSAP_8021D && dsap == LLCSAP_8021D &&
278  control == LLC_UI) {
279  stp_print(ndo, p, length);
280  return (hdrlen);
281  }
282 
283  if (ssap == LLCSAP_IP && dsap == LLCSAP_IP &&
284  control == LLC_UI) {
285  /*
286  * This is an RFC 948-style IP packet, with
287  * an 802.3 header and an 802.2 LLC header
288  * with the source and destination SAPs being
289  * the IP SAP.
290  */
291  ip_print(ndo, p, length);
292  return (hdrlen);
293  }
294 
295  if (ssap == LLCSAP_IPX && dsap == LLCSAP_IPX &&
296  control == LLC_UI) {
297  /*
298  * This is an Ethernet_802.2 IPX frame, with an 802.3
299  * header and an 802.2 LLC header with the source and
300  * destination SAPs being the IPX SAP.
301  */
302  if (ndo->ndo_eflag)
303  ND_PRINT("IPX 802.2: ");
304 
305  ipx_print(ndo, p, length);
306  return (hdrlen);
307  }
308 
309 #ifdef ENABLE_SMB
310  if (ssap == LLCSAP_NETBEUI && dsap == LLCSAP_NETBEUI
311  && (!(control & LLC_S_FMT) || control == LLC_U_FMT)) {
312  /*
313  * we don't actually have a full netbeui parser yet, but the
314  * smb parser can handle many smb-in-netbeui packets, which
315  * is very useful, so we call that
316  *
317  * We don't call it for S frames, however, just I frames
318  * (which are frames that don't have the low-order bit,
319  * LLC_S_FMT, set in the first byte of the control field)
320  * and UI frames (whose control field is just 3, LLC_U_FMT).
321  */
322  netbeui_print(ndo, control, p, length);
323  return (hdrlen);
324  }
325 #endif
326  if (ssap == LLCSAP_ISONS && dsap == LLCSAP_ISONS
327  && control == LLC_UI) {
328  isoclns_print(ndo, p, length);
329  return (hdrlen);
330  }
331 
332  if (!ndo->ndo_eflag) {
333  if (ssap == dsap) {
334  if (src == NULL || dst == NULL)
335  ND_PRINT("%s ", tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
336  else
337  ND_PRINT("%s > %s %s ",
338  (src->addr_string)(ndo, src->addr),
339  (dst->addr_string)(ndo, dst->addr),
340  tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
341  } else {
342  if (src == NULL || dst == NULL)
343  ND_PRINT("%s > %s ",
344  tok2str(llc_values, "Unknown SSAP 0x%02x", ssap),
345  tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
346  else
347  ND_PRINT("%s %s > %s %s ",
348  (src->addr_string)(ndo, src->addr),
349  tok2str(llc_values, "Unknown SSAP 0x%02x", ssap),
350  (dst->addr_string)(ndo, dst->addr),
351  tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
352  }
353  }
354 
355  if (is_u) {
356  ND_PRINT("Unnumbered, %s, Flags [%s], length %u",
357  tok2str(llc_cmd_values, "%02x", LLC_U_CMD(control)),
358  tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_U_POLL)),
359  length + hdrlen);
360 
361  if ((control & ~LLC_U_POLL) == LLC_XID) {
362  if (length == 0) {
363  /*
364  * XID with no payload.
365  * This could, for example, be an SNA
366  * "short form" XID.
367  */
368  return (hdrlen);
369  }
370  if (caplen < 1) {
371  nd_print_trunc(ndo);
372  if (caplen > 0)
373  ND_DEFAULTPRINT((const u_char *)p, caplen);
374  return (hdrlen);
375  }
376  if (GET_U_1(p) == LLC_XID_FI) {
377  if (caplen < 3 || length < 3) {
378  nd_print_trunc(ndo);
379  if (caplen > 0)
380  ND_DEFAULTPRINT((const u_char *)p, caplen);
381  } else
382  ND_PRINT(": %02x %02x",
383  GET_U_1(p + 1),
384  GET_U_1(p + 2));
385  return (hdrlen);
386  }
387  }
388  } else {
389  if ((control & LLC_S_FMT) == LLC_S_FMT) {
390  ND_PRINT("Supervisory, %s, rcv seq %u, Flags [%s], length %u",
392  LLC_IS_NR(control),
393  tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)),
394  length + hdrlen);
395  return (hdrlen); /* no payload to print */
396  } else {
397  ND_PRINT("Information, send seq %u, rcv seq %u, Flags [%s], length %u",
398  LLC_I_NS(control),
399  LLC_IS_NR(control),
400  tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)),
401  length + hdrlen);
402  }
403  }
404  return (-hdrlen);
405 }
406 
407 static const struct tok *
408 oui_to_struct_tok(uint32_t orgcode)
409 {
410  const struct tok *tok = null_values;
411  const struct oui_tok *otp;
412 
413  for (otp = &oui_to_tok[0]; otp->tok != NULL; otp++) {
414  if (otp->oui == orgcode) {
415  tok = otp->tok;
416  break;
417  }
418  }
419  return (tok);
420 }
421 
422 int
423 snap_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen,
424  const struct lladdr_info *src, const struct lladdr_info *dst,
425  u_int bridge_pad)
426 {
427  uint32_t orgcode;
428  u_short et;
429  int ret;
430 
431  ndo->ndo_protocol = "snap";
432  ND_TCHECK_5(p);
433  if (caplen < 5 || length < 5)
434  goto trunc;
435  orgcode = GET_BE_U_3(p);
436  et = GET_BE_U_2(p + 3);
437 
438  if (ndo->ndo_eflag) {
439  /*
440  * Somebody's already printed the MAC addresses, if there
441  * are any, so just print the SNAP header, not the MAC
442  * addresses.
443  */
444  ND_PRINT("oui %s (0x%06x), %s %s (0x%04x), length %u: ",
445  tok2str(oui_values, "Unknown", orgcode),
446  orgcode,
447  (orgcode == 0x000000 ? "ethertype" : "pid"),
448  tok2str(oui_to_struct_tok(orgcode), "Unknown", et),
449  et, length - 5);
450  }
451  p += 5;
452  length -= 5;
453  caplen -= 5;
454 
455  switch (orgcode) {
456  case OUI_ENCAP_ETHER:
457  case OUI_CISCO_90:
458  /*
459  * This is an encapsulated Ethernet packet,
460  * or a packet bridged by some piece of
461  * Cisco hardware; the protocol ID is
462  * an Ethernet protocol type.
463  */
464  ret = ethertype_print(ndo, et, p, length, caplen, src, dst);
465  if (ret)
466  return (ret);
467  break;
468 
469  case OUI_APPLETALK:
470  if (et == ETHERTYPE_ATALK) {
471  /*
472  * No, I have no idea why Apple used one
473  * of their own OUIs, rather than
474  * 0x000000, and an Ethernet packet
475  * type, for Appletalk data packets,
476  * but used 0x000000 and an Ethernet
477  * packet type for AARP packets.
478  */
479  ret = ethertype_print(ndo, et, p, length, caplen, src, dst);
480  if (ret)
481  return (ret);
482  }
483  break;
484 
485  case OUI_CISCO:
486  switch (et) {
487  case PID_CISCO_CDP:
488  cdp_print(ndo, p, length);
489  return (1);
490  case PID_CISCO_DTP:
491  dtp_print(ndo, p, length);
492  return (1);
493  case PID_CISCO_UDLD:
494  udld_print(ndo, p, length);
495  return (1);
496  case PID_CISCO_VTP:
497  vtp_print(ndo, p, length);
498  return (1);
499  case PID_CISCO_PVST:
501  stp_print(ndo, p, length);
502  return (1);
503  default:
504  break;
505  }
506  break;
507 
508  case OUI_RFC2684:
509  switch (et) {
510 
511  case PID_RFC2684_ETH_FCS:
513  /*
514  * XXX - remove the last two bytes for
515  * PID_RFC2684_ETH_FCS?
516  */
517  /*
518  * Skip the padding.
519  */
520  ND_TCHECK_LEN(p, bridge_pad);
521  caplen -= bridge_pad;
522  length -= bridge_pad;
523  p += bridge_pad;
524 
525  /*
526  * What remains is an Ethernet packet.
527  */
528  ether_print(ndo, p, length, caplen, NULL, NULL);
529  return (1);
530 
533  /*
534  * XXX - remove the last two bytes for
535  * PID_RFC2684_ETH_FCS?
536  */
537  /*
538  * Skip the padding, but not the Access
539  * Control field.
540  */
541  ND_TCHECK_LEN(p, bridge_pad);
542  caplen -= bridge_pad;
543  length -= bridge_pad;
544  p += bridge_pad;
545 
546  /*
547  * What remains is an 802.5 Token Ring
548  * packet.
549  */
550  token_print(ndo, p, length, caplen);
551  return (1);
552 
555  /*
556  * XXX - remove the last two bytes for
557  * PID_RFC2684_ETH_FCS?
558  */
559  /*
560  * Skip the padding.
561  */
562  ND_TCHECK_LEN(p, bridge_pad + 1);
563  caplen -= bridge_pad + 1;
564  length -= bridge_pad + 1;
565  p += bridge_pad + 1;
566 
567  /*
568  * What remains is an FDDI packet.
569  */
570  fddi_print(ndo, p, length, caplen);
571  return (1);
572 
573  case PID_RFC2684_BPDU:
574  stp_print(ndo, p, length);
575  return (1);
576  }
577  }
578  if (!ndo->ndo_eflag) {
579  /*
580  * Nobody printed the link-layer addresses, so print them, if
581  * we have any.
582  */
583  if (src != NULL && dst != NULL) {
584  ND_PRINT("%s > %s ",
585  (src->addr_string)(ndo, src->addr),
586  (dst->addr_string)(ndo, dst->addr));
587  }
588  /*
589  * Print the SNAP header, but if the OUI is 000000, don't
590  * bother printing it, and report the PID as being an
591  * ethertype.
592  */
593  if (orgcode == 0x000000) {
594  ND_PRINT("SNAP, ethertype %s (0x%04x), length %u: ",
595  tok2str(ethertype_values, "Unknown", et),
596  et, length);
597  } else {
598  ND_PRINT("SNAP, oui %s (0x%06x), pid %s (0x%04x), length %u: ",
599  tok2str(oui_values, "Unknown", orgcode),
600  orgcode,
601  tok2str(oui_to_struct_tok(orgcode), "Unknown", et),
602  et, length);
603  }
604  }
605  return (0);
606 
607 trunc:
608  nd_print_trunc(ndo);
609  return (1);
610 }
#define ETHERTYPE_ATALK
Definition: ethertype.h:103
const struct tok ethertype_values[]
Definition: print-ether.c:52
#define GET_BE_U_3(p)
Definition: extract.h:876
#define GET_BE_U_2(p)
Definition: extract.h:875
#define GET_LE_U_2(p)
Definition: extract.h:897
#define ND_TCHECK_5(p)
Definition: extract.h:564
#define GET_U_1(p)
Definition: extract.h:872
#define LLC_IG
Definition: llc.h:28
#define LLC_XID
Definition: llc.h:42
#define LLC_U_CMD(u)
Definition: llc.h:35
#define LLCSAP_IPX
Definition: llc.h:90
#define PID_CISCO_UDLD
Definition: llc.h:105
#define PID_RFC2684_802_4_NOFCS
Definition: llc.h:115
#define PID_CISCO_DTP
Definition: llc.h:104
#define LLC_I_NS(is)
Definition: llc.h:51
#define LLC_SABME
Definition: llc.h:40
#define PID_CISCO_VLANBRIDGE
Definition: llc.h:107
#define LLC_XID_FI
Definition: llc.h:33
#define PID_RFC2684_802_6_NOFCS
Definition: llc.h:121
#define LLCSAP_ISO8208
Definition: llc.h:81
#define LLCSAP_RS511
Definition: llc.h:78
#define LLCSAP_SNA
Definition: llc.h:66
#define LLC_TEST
Definition: llc.h:41
#define LLC_UA
Definition: llc.h:37
#define LLCSAP_8021B_I
Definition: llc.h:60
#define LLC_UI
Definition: llc.h:36
#define LLC_GSAP
Definition: llc.h:27
#define PID_RFC2684_FDDI_NOFCS
Definition: llc.h:119
#define PID_RFC2684_BPDU
Definition: llc.h:122
#define LLCSAP_NETBEUI
Definition: llc.h:93
#define LLC_IS_NR(is)
Definition: llc.h:50
#define LLCSAP_SNAP
Definition: llc.h:87
#define PID_RFC2684_802_5_FCS
Definition: llc.h:116
#define LLCSAP_PROWAY
Definition: llc.h:84
#define LLC_U_POLL
Definition: llc.h:31
#define PID_RFC2684_ETH_FCS
Definition: llc.h:112
#define LLC_U_FMT
Definition: llc.h:26
#define LLC_DISC
Definition: llc.h:38
#define LLCSAP_IP
Definition: llc.h:69
#define LLC_FRMR
Definition: llc.h:43
#define PID_CISCO_CDP
Definition: llc.h:102
#define LLCSAP_GLOBAL
Definition: llc.h:57
#define PID_RFC2684_802_6_FCS
Definition: llc.h:120
#define PID_CISCO_VTP
Definition: llc.h:103
#define PID_RFC2684_FDDI_FCS
Definition: llc.h:118
#define PID_RFC2684_ETH_NOFCS
Definition: llc.h:113
#define LLCSAP_PROWAYNM
Definition: llc.h:72
#define LLC_DM
Definition: llc.h:39
#define LLC_S_FMT
Definition: llc.h:29
#define LLCSAP_8021D
Definition: llc.h:75
#define PID_CISCO_PVST
Definition: llc.h:106
#define LLCSAP_NULL
Definition: llc.h:54
#define LLCSAP_ISONS
Definition: llc.h:96
#define LLCSAP_8021B_G
Definition: llc.h:63
#define LLC_IS_POLL
Definition: llc.h:32
#define PID_RFC2684_802_4_FCS
Definition: llc.h:114
#define PID_RFC2684_802_5_NOFCS
Definition: llc.h:117
#define LLC_S_CMD(is)
Definition: llc.h:45
u_int fddi_print(netdissect_options *, const u_char *, u_int, u_int)
Definition: print-fddi.c:277
void dtp_print(netdissect_options *, const u_char *, u_int)
Definition: print-dtp.c:47
#define ND_TCHECK_LEN(p, l)
Definition: netdissect.h:368
const char * tok2str(const struct tok *, const char *, u_int)
Definition: util-print.c:485
int ethertype_print(netdissect_options *, u_short, const u_char *, u_int, u_int, const struct lladdr_info *, const struct lladdr_info *)
Definition: print-ether.c:522
void isoclns_print(netdissect_options *, const u_char *, u_int)
void cdp_print(netdissect_options *, const u_char *, u_int)
Definition: print-cdp.c:234
#define ND_DEFAULTPRINT(ap, length)
Definition: netdissect.h:386
void nd_print_trunc(netdissect_options *)
Definition: util-print.c:409
u_int token_print(netdissect_options *, const u_char *, u_int, u_int)
Definition: print-token.c:146
void vtp_print(netdissect_options *, const u_char *, const u_int)
Definition: print-vtp.c:120
void ip_print(netdissect_options *, const u_char *, u_int)
Definition: print-ip.c:319
u_int ether_print(netdissect_options *, const u_char *, u_int, u_int, void(*)(netdissect_options *, const u_char *), const u_char *)
void udld_print(netdissect_options *, const u_char *, u_int)
Definition: print-udld.c:104
#define ND_PRINT(...)
Definition: netdissect.h:385
void netbeui_print(netdissect_options *, u_short, const u_char *, u_int)
Definition: print-smb.c:1354
void ipx_print(netdissect_options *, const u_char *, u_int)
Definition: print-ipx.c:73
void stp_print(netdissect_options *, const u_char *, u_int)
Definition: print-stp.c:375
const struct tok oui_values[]
Definition: oui.c:26
#define OUI_CISCO
Definition: oui.h:20
#define OUI_CISCO_90
Definition: oui.h:23
#define OUI_RFC2684
Definition: oui.h:24
#define OUI_ENCAP_ETHER
Definition: oui.h:19
#define OUI_APPLETALK
Definition: oui.h:27
static const struct tok llc_cmd_values[]
Definition: print-llc.c:60
static const struct tok llc_flag_values[]
Definition: print-llc.c:72
int llc_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen, const struct lladdr_info *src, const struct lladdr_info *dst)
Definition: print-llc.c:150
static const struct tok null_values[]
Definition: print-llc.c:123
static const struct tok llc_ig_flag_values[]
Definition: print-llc.c:83
int snap_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen, const struct lladdr_info *src, const struct lladdr_info *dst, u_int bridge_pad)
Definition: print-llc.c:423
static const struct tok llc_supervisory_values[]
Definition: print-llc.c:90
static const struct oui_tok oui_to_tok[]
Definition: print-llc.c:132
static const struct tok * oui_to_struct_tok(uint32_t orgcode)
Definition: print-llc.c:408
static const struct tok llc_values[]
Definition: print-llc.c:41
static const struct tok cisco_values[]
Definition: print-llc.c:98
static const struct tok bridged_values[]
Definition: print-llc.c:108
const u_char * addr
Definition: netdissect.h:545
const char *(* addr_string)(netdissect_options *, const u_char *)
Definition: netdissect.h:544
const char * ndo_protocol
Definition: netdissect.h:218
uint32_t oui
Definition: print-llc.c:128
const struct tok * tok
Definition: print-llc.c:129